[quocle108]

Description

The daemon verified the passphrase only when opening a wallet from cold. On the already-unlocked path it reset the session timer and returned ok without checking, so unlock_wallet is now verified on every call. It also rejects a ttl it cannot honour, in the CLI parser and in the daemon.

Motivation and Context

Any socket peer could extend or shorten a live session with a wrong passphrase, including setting it to never expire. The CLI masked this by decrypting locally before contacting the daemon, but scripts and raw socket peers get no such check

Related Issue

Closes #

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update

[jonathunne]

Looks good! One remaining gap: for a wallet that's already unlocked, the passphrase is checked against the seed file on disk, not against the seed the live session holds. A process running as the same user can swap in its own seed file, unlock with its own passphrase and ttl: 0, then put the original back, and the real session never expires.

I'd suggest storing a hash of the seed at first unlock and refusing later unlocks that don't match.